Exam AZ-104 topic 2 question 1 discussion

The given answer is incorrect: Box 1. Network Contributor on RG1 Box 2. Network Contributor on RG1

Network Contributor on LB1 Network Contributor on LB2 Network Contributor role on LB1 and LB2 is the correct answer. With this role user can add create a backend address without actually adding the actual IP addresses. Network contributor can also create and modify health probe. If the user wants to add address to backend pools (eg: IPs from a VNet or entire subnet) then a Network Contributor role is required at the resource group level (or atleast on VNet)

I think what is tripping people up in the first box is whether we are creating or adding an existing backend pool. You need RG1 if you are creating a backend pool but this says adding a backend pool which is a function of the loadbalancer configuration.

Network Contributor to LB1 and LB2. The statement says that the LBs are already created, and Admin 1 needs these right with leatst priviliges. You are not Admin 1...Admin 1 is another user and giving him "Contributor to the RGs" is too broad.

Tested and confirmed in a lab, the correct answers are NetworkContributor on RG1

Copilot answer: "Both solutions are valid, but the preferable one depends on your specific needs and management preferences: Assigning the Network Contributor role at the resource group level (RG1): Pros: Simplifies role management by granting Admin1 permissions to manage all network-related resources within the resource group, including both LB1 and LB2. Cons: Admin1 will have broader access, which might include other network resources in RG1 that they don’t need to manage. Assigning the Network Contributor role directly to LB1 and LB2: Pros: Follows the principle of least privilege more strictly by limiting Admin1’s access to only the specific load balancers they need to manage. Cons: Requires more granular role assignments, which can be more complex to manage if there are many resources. If you want to keep things simple and Admin1 needs to manage multiple network resources within RG1, assigning the role at the resource group level is preferable. However, if you want to strictly limit Admin1’s access to only the load balancers, assigning the role directly to LB1 and LB2 is the better choice."

Network contributor to LB is the latest permission, but not work in real life. You need be network contributor to RG1

According to the response from Microsoft, which specifies the permissions of the 'Network Contributor' role in the resource group LB, the correct answer, in my opinion, looks like this: Box 1. Network Contributor on LB1 Box 2. Network Contributor on RG1

I'm glad the discussion basically has every possibility.

Network Contributor on LB1 and LB2 (to either add backend pool or health probe). Source: https://learn.microsoft.com/en-us/azure/role-based-access-control/permissions/networking#microsoftnetwork

Network Contributor for LB1 (add backend pool) Network Contributor for LB2 (add healthprobe) Source: https://learn.microsoft.com/en-us/azure/role-based-access-control/permissions/networking#microsoftnetwork

The correct answer would be - 1. Network Contributor on RG1 2. Network Contributor on LB2 The "Network Contributor" role provides permissions to manage network resources such as virtual networks, subnets, network interfaces, and IP addresses. While it does grant certain permissions related to load balancers, such as managing load balancing rules and probes, it does not provide the necessary permissions to add or modify backend VMs associated with the load balancer. To add backend VMs to a load balancer, the user would require additional permissions, specifically the "Virtual Machine Contributor" role or higher. So, the Network Contributor on RG1 option would be the only viable option for the first answer. Link - https://learn.microsoft.com/en-us/answers/questions/1288486/network-contributor

Come on guys, how is it possible that these questions are so confusing that the community can't even reach to a consensus for the right answer. So what's the correct answer here? Network Contributor on RG1 Network Contributor on RG1 Or Network Contributor on LB1 Network Contributor on LB2

WRONG - Network Contributor on RG1 - Network Contributor on RG1

wrong 1st. Network Contributor on RG1 2nd. Network Contributor on RG1

Yes, you can assign Admin1 the "Network Contributor" role directly to LB1 and LB2 instead of the entire resource group. This would follow the principle of least privilege more closely by limiting Admin1's permissions specifically to those two load balancers. So the Answer is correct! .. Network Contributor on LB1 & Network Contributor on LB2 ..

Correct answer is : box 1: 3 - network contributor access on RG1 box2: 3 - network contributor access on RG1 if we give network contributor access on LB level then we wont be able to access the Lb resource. hence network contributor access on resource level is required. I found out this after long lab session. hope its helps.